A technician encounters prohibited materials on a computer located in a common area that is used by several employees. Which of the following should be done FIRST?

The correct answer is D. Report the incident to management. The correct first response when discovering prohibited materials is to report the incident to management (or the appropriate authority such as HR or a supervisor) without tampering with the evidence. Removing the item (A) would destroy evidence and could expose the technician…

Hardware

Question

Options

ARemove the item from the computer
BShow to others so they can be a witness
CCopy the item to an external website
DReport the incident to management

How the community answered

(45 responses)

A
16% (7)
B
9% (4)
C
4% (2)
D
71% (32)

Explanation

The correct first response when discovering prohibited materials is to report the incident to management (or the appropriate authority such as HR or a supervisor) without tampering with the evidence. Removing the item (A) would destroy evidence and could expose the technician to legal liability. Showing it to coworkers (B) violates confidentiality, compromises the integrity of the incident, and could be seen as distributing the material. Copying it to an external website (C) is illegal and highly inappropriate. Reporting first preserves the chain of custody, protects the technician legally, and ensures the organization can handle the situation through proper channels. This is a foundational principle in IT incident response and workplace professionalism.

Topics

#prohibited content#incident response#professional conduct#policy compliance

Community Discussion

No community discussion yet for this question.

Full 220-801 Practice